Use esc_url() instead of esc_attr() for src="".